A weekly AppSec report for engineering managers should fit on one page and answer four things: what is overdue, what is new and urgent, what changed since last week, and which items need a decision. Everything else belongs in the dashboard for people who want to look.
Why one page
Managers read what they can act on in two minutes. A twenty page export gets archived. The report exists to trigger specific work, so each line should end with an owner and a date.
The layout
| Section | Content | Size |
|---|---|---|
| Overdue | Findings past SLA, by team, oldest first | Top 5 |
| New and urgent | New critical findings and any known exploited items | All of them, usually few |
| Movement | Opened, closed, net since last week | One line |
| Decisions | Exceptions expiring, fix blocked, scope questions | 3 items max |
| Coverage | Repositories scanned versus total | One number with denominator |
Writing the lines
Be specific. "Payments service has 2 high findings past SLA, oldest 41 days, owner Priya" is a line someone can act on. "Several vulnerabilities remain open" is not.
State the ask. "Decision needed by Thursday: accept or fix the legacy parser issue." If no decision is needed, say so.
What to leave out
- Total open counts without context.
- Severity percentages with tiny populations.
- Tool names, scan IDs and jargon engineering leads do not use.
- Praise for the security team.
Steps to automate
- Define each number once, in a short definition card, so the report always means the same thing.
- Pull from the finding system, not from a spreadsheet kept by hand.
- Generate on a fixed day, so managers know when to expect it.
- Send to the team channel, not individual inboxes, to make overdue items visible.
- Review the format monthly. Drop a section nobody has used.
One caution
Do not turn the report into a league table. Ranking teams by open findings rewards hiding findings. Compare each team to its own previous weeks instead.
Safeguard supports this with vulnerability tracking, policies and gates, and you can run a free scan at gold.safeguard.sh/scan.
Quick check
How many metrics belong in a weekly report?
Five or fewer, each tied to an action or an owner.
Should we rank teams by findings?
No. Compare teams to their own trend, since ranking encourages under-reporting.
Last reviewed: 19 October 2026.
